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CLAIMS 

What is claimed is: 



1 1. A method comprising: 

2 providing a plurality of bins stored in a memory, each of the bins including a number of 

3 rules, each rule specifying a source port range and a destination port range; 

4 identifying, from the plurality of bins, a bin corresponding to a network path and a 

5 protocol of a received packet; 

6 comparing a source port and a destination port of the received packet with the rules of the 

7 corresponding bin; and 

8 if the source port of the received packet is within the source port range of a rule and the 

9 destination port of the received packet is within the destination port range of the 
10 rule, applying an action associated with the rule to the received packet. 

1 2. The method of claim 1, wherein the rule matching the source and 

2 destination ports of the received packet comprises a highest priority matching rule. 

1 3. The method of claim 1, wherein: 

2 the source port range of each rule is specified by a source port lower bound and a source 

3 port upper bound; 

4 and the destination port range of each rule is specified by a destination port lower bound 

5 and a destination port upper bound. 
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1 4. The method of claim 3, wherein: 

2 the source port of the received packet is within the source port range of a rule if the 

3 packet's source port is greater than or equal to the source port lower bound of the 

4 rule and less than or equal to the source port upper bound of the rule; and 

5 the destination port of the received packet is within the destination port range of the rule 

6 if the packet's destination port is greater than or equal to the destination port 

7 lower bound of the rule and less than or equal to the destination port upper bound 

8 of the rule. 

1 5. The method of claim 1, wherein identifying a bin corresponding to a 

2 network path and a protocol of a received packet comprises: 

3 identifying, from a number of entries in a data structure, an entry having a source address 

4 prefix matching a source address of the received packet, the matching entry 

5 including a first identifier; 

6 identifying, from a number of entries in another data structure, an entry having a 

7 destination address prefix matching a destination address of the received packet, 

8 the matching entry including a second identifier; and 

9 identifying, from the number of bins, a bin corresponding to the first and second 
10 identifiers and the protocol. 
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1 6. The method of claim 1, wherein identifying a bin corresponding to a 

2 network path and a protocol of a received packet comprises: 

3 searching a source address data structure to find a first index and a third index, the first 

4 index associated with a fully specified filter having a source prefix matching the 

5 source address of the packet, the third index associated with a partially specified 

6 filter having a source prefix matching the source address of the packet; 

7 searching a destination address data structure to find a second index and a fourth index, 

8 the second index associated with a fully specified filter having a destination prefix 

9 matching the destination address of the packet, the fourth index associated with a 

10 partially specified filter having a destination prefix matching the destination 

1 1 address of the packet; 

12 forming a key from the first index, the second index, and the protocol; and 

13 searching a primary table for an entry matching the key, the primary table including a 

14 number of entries, each entry corresponding to one of a fully specified filter, a 

15 fully specified filter intersection, and an indicator filter; 

16 wherein an entry of the primary table matching the key will identify the corresponding 

17 bin. 
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1 7. The method of claim 6, further comprising: 

2 searching a first of two secondary tables for an entry matching a key formed from the 

3 third index and the protocol, the first secondary table including a number of 

4 entries, each entry corresponding to a partially specified filter; and 

5 searching a second of the two secondary tables for an entry matching a key formed from 

6 the fourth index and the protocol, the second secondary table including a number 

7 of entries, each entry corresponding to a partially specified filter; 

8 wherein, if no match is found in the primary table, a matching entry in one of the two 

9 secondary tables will identify the corresponding bin. 

1 8. The method of claim 7, wherein, if no match is found in the primary table 

2 or either of the secondary tables, the corresponding bin comprises a default bin associated 

3 with an entire two-dimensional address space. 
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1 9. The method of claim 6, further comprising: 

2 searching the source address data structure to find a fifth index associated with a wide 

3 filter having a source prefix matching the source address of the packet; 

4 searching the destination address data structure to find a sixth index associated with a 

5 wide filter having a destination prefix matching the destination address of the 

6 packet; 

7 forming a second key from the fifth index, the sixth index, and the protocol; and 

8 searching a wide filter table for an entry matching the second key, the wide filter table 

9 including a number of entries, each entry corresponding to a wide filter; 

10 wherein, if no match is found in the primary table, a matching entry the wide filter table 

1 1 will identify the corresponding bin. 

1 10. The method of claim 9, wherein each wide filter contained in the wide 

2 filter table comprises a fully specified filter having a number of indicator filters 

3 exceeding a specified threshold. 
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1 1 1 . A method comprising: 

2 identifying, from a plurality of bins stored in a memory, a bin corresponding to a network 

3 path of a received packet, each of the bins including a number of rules; 

4 issuing a command to a classification circuit, the command identifying the corresponding 

5 bin; 

6 copying the rules of the corresponding bin from the memory to the classification circuit, 

7 wherein the classification circuit compares at least one transport level field of the 

8 received packet with each of the rules and provides a match signal if a rule 

9 matches the at least one transport level field of the packet; and 

10 in response to the match signal, applying an action associated with the matching rule to 

1 1 the received packet. 

1 12. The method of claim 11, wherein the matching rule comprises a highest 

2 priority matching rule. 

1 13. The method of claim 11, wherein the at least one transport level field of 

2 the received packet comprises a source port and a destination port. 

1 14. The method of claim 13, wherein each rule of a bin includes a source port 

2 lower bound, a source port upper bound, a destination port lower bound, and a destination 

3 port upper bound. 
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1 15. The method of claim 14, wherein a rule matches the at least one transport 

2 level field of the packet if: 

3 the source port of the received packet is greater than or equal to the source port lower 

4 bound of the rule and less than or equal to the source port upper bound of the rule; 

5 and 

6 the destination port of the received packet is greater than or equal to the destination port 

7 lower bound of the rule and less than or equal to the destination port upper bound 

8 of the rule. 

1 16. The method of claim 11, wherein the corresponding bin further 

2 corresponds to a protocol associated with the received packet. 

1 17. The method of claim 16, wherein identifying a bin corresponding to a 

2 network path of a received packet comprises: 

3 identifying, from a number of entries in a data structure, an entry having a source address 

4 prefix matching the source address of the received packet, the matching entry 

5 including a first identifier; 

6 identifying, from a number of entries in another data structure, an entry having a 

7 destination address prefix matching the destination address of the received packet, 

8 the matching entry including a second identifier; and 

9 identifying, from the number of bins, a bin corresponding to the first and second 
10 identifiers and the protocol. 
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1 18. The method of claim 16, wherein identifying a bin corresponding to a 

2 network path of a received packet comprises: 

3 searching a source address data structure to find a first index and a third index, the first 

4 index associated with a fully specified filter having a source prefix matching the 

5 source address of the packet, the third index associated with a partially specified 

6 filter having a source prefix matching the source address of the packet; 

7 searching a destination address data structure to find a second index and a fourth index, 

8 the second index associated with a fully specified filter having a destination prefix 

9 matching the destination address of the packet, the fourth index associated with a 

10 partially specified filter having a destination prefix matching the destination 

1 1 address of the packet; 

12 forming a key from the first index, the second index, and the protocol; and 

13 searching a primary table for an entry matching the key, the primary table including a 

14 number of entries, each entry corresponding to one of a fully specified filter, a 

15 fully specified filter intersection, and an indicator filter; 

16 wherein an entry of the primary table matching the key will identify the corresponding 

17 bin. 
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1 19. The method of claim 18, further comprising: 

2 searching a first of two secondary tables for an entry matching a key formed from the 

3 third index and the protocol, the first secondary table including a number of 

4 entries, each entry corresponding to a partially specified filter; and 

5 searching a second of the two secondary tables for an entry matching a key formed from 

6 the fourth index and the protocol, the second secondary table including a number 

7 of entries, each entry corresponding to a partially specified filter; 

8 wherein, if no match is found in the primary table, a matching entry in one of the two 

9 secondary tables will identify the corresponding bin. 

1 20. The method of claim 19, wherein, if no match is found in the primary table 

2 or either of the secondary tables, the corresponding bin comprises a default bin associated 

3 with an entire two-dimensional address space. 
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1 21. The method of claim 1 8, further comprising: 

2 searching the source address data structure to find a fifth index associated with a wide 

3 filter having a source prefix matching the source address of the packet; 

4 searching the destination address data structure to find a sixth index associated with a 

5 wide filter having a destination prefix matching the destination address of the 

6 packet; 

7 forming a second key from the fifth index, the sixth index, and the protocol; and 

8 searching a wide filter table for an entry matching the second key, the wide filter table 

9 including a number of entries, each entry corresponding to a wide filter; 

10 wherein, if no match is found in the primary table, a matching entry the wide filter table 

1 1 will identify the corresponding bin. 

1 22. The method of claim 21, wherein each wide filter contained in the wide 

2 filter table comprises a fully specified filter having a number of indicator filters 

3 exceeding a specified threshold. 
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1 23. An apparatus comprising: 

2 a memory, the memory having a plurality of bins stored therein, each bin including a 

3 number of rules; 

4 a processing system, the processing system programmed to identify, from the plurality of 

5 bins, a bin corresponding to a network path of a received packet; and 

6 a classification circuit coupled with the memory and the processing system, the 

7 classification circuit to identify, from the rules of the corresponding bin, a rule 

8 matching at least one transport level field of the packet. 

1 24. The apparatus of claim 23, wherein the rule matching the at least one 

2 transport level field comprises a highest priority matching rule. 

1 25. The apparatus of claim 23, wherein the at least one transport level field of 

2 the packet includes a source port and a destination port, and wherein each rule of a bin 

3 includes a source port lower bound, a source port upper bound, a destination port lower 

4 bound, and a destination port upper bound. 
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1 26. The apparatus of claim 25, wherein the classification circuit comprises: 

2 a first comparison circuit to compare the source port of the received packet with the 

3 source port lower and upper bounds of one of the rules; 

4 a second comparison circuit to compare the destination port of the received packet with 

5 the destination port lower and upper bounds of the rule; and 

6 an output circuit to output a match signal if a rule of the corresponding bin matches the 

7 source and destination ports of the received packet. 

1 27. The apparatus of claim 26, wherein the rule matches the source and 

2 destination ports of the received packet if: 

3 the source port of the received packet is greater than or equal to the source port lower 

4 bound of the rule and less than or equal to the source port upper bound of the rule; 

5 and 

6 the destination port of the received packet is greater than or equal to the destination port 

7 lower bound of the rule and less than or equal to the destination port upper bound 

8 of the rule. 
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1 28. The apparatus of claim 23, wherein the corresponding bin further 

2 corresponds to a protocol associated with the received packet. 

1 29. The apparatus of claim 28, wherein to identify a bin corresponding to a 

2 network path of a received packet, the processing system is programmed to perform 

3 operations including: 

4 identifying, from a number of entries in a data structure, an entry having a source address 

5 prefix matching the source address of the received packet, the matching entry 

6 including a first identifier; 

7 identifying, from a number of entries in another data structure, an entry having a 

8 destination address prefix matching the destination address of the received packet, 

9 the matching entry including a second identifier; and 

10 identifying, from the number of bins, a bin corresponding to the first and second 

1 1 identifiers and the protocol. 
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1 30. The apparatus of claim 28, wherein to identify a bin corresponding to a 

2 network path of a received packet, the processing system is programmed to perform 

3 operations including: 

4 searching a source address data structure to find a first index and a third index, the first 

5 index associated with a fully specified filter having a source prefix matching the 

6 source address of the packet, the third index associated with a partially specified 

7 filter having a source prefix matching the source address of the packet; 

8 searching a destination address data structure to find a second index and a fourth index, 

9 the second index associated with a fully specified filter having a destination prefix 

10 matching the destination address of the packet, the fourth index associated with a 

1 1 partially specified filter having a destination prefix matching the destination 

12 address of the packet; 

13 forming a key from the first index, the second index, and the protocol; and 

14 searching a primary table for an entry matching the key, the primary table including a 

15 number of entries, each entry corresponding to one of a fully specified filter, a 

16 fully specified filter intersection, and an indicator filter; 

17 wherein an entry of the primary table matching the key will identify the corresponding 

18 bin. 
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1 31. The apparatus of claim 30, wherein to identify a bin corresponding to a 

2 network path of a received packet, the processing system is programmed to perform 

3 operations further including: 

4 searching a first of two secondary tables for an entry matching a key formed from the 

5 third index and the protocol, the first secondary table including a number of 

6 entries, each entry corresponding to a partially specified filter; and 

7 searching a second of the two secondary tables for an entry matching a key formed from 

8 the fourth index and the protocol, the second secondary table including a number 

9 of entries, each entry corresponding to a partially specified filter; 

10 wherein, if no match is found in the primary table, a matching entry in one of the two 

1 1 secondary tables will identify the corresponding bin. 

1 32, The apparatus of claim 31, wherein, if no match is found in the primary 

2 table or either of the secondary tables, the corresponding bin comprises a default bin 

3 associated with an entire two-dimensional address space. 
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1 33. The apparatus of claim 30, wherein to identify a bin corresponding to a 

2 network path of a received packet, the processing system is programmed to perform 

3 operations further including: 

4 searching the source address data structure to find a fifth index associated with a wide 

5 filter having a source prefix matching the source address of the packet; 

6 searching the destination address data structure to find a sixth index associated with a 

7 wide filter having a destination prefix matching the destination address of the 

8 packet; 

9 forming a second key from the fifth index, the sixth index, and the protocol; and 

10 searching a wide filter table for an entry matching the second key, the wide filter table 

1 1 including a number of entries, each entry corresponding to a wide filter; 

12 wherein, if no match is found in the primary table, a matching entry the wide filter table 

13 will identify the corresponding bin. 

1 34. The apparatus of claim 33, wherein each wide filter contained in the wide 

2 filter table comprises a fully specified filter having a number of indicator filters 

3 exceeding a specified threshold. 

1 35. The apparatus of claim 23, wherein the memory, the processing system, 

2 and the classification circuit comprise a single processing device. 



-79- 



Docket No. PI 7967 



Express Mail No. EV325529653US 



1 36. A system comprising: 

2 a bus; 

3 a processing device coupled with the bus, the processing device including 

4 a memory, the memory having a plurality of bins stored therein, each bin 

5 including a number of rules, 

6 a processing engine, the processing engine programmed to identify, from 

7 the plurality of bins, a bin corresponding to a network path of a 

8 received packet, and 

9 a classification circuit coupled with the memory and the processing 

10 engine, the classification circuit to identify, from the rules of the 

1 1 corresponding bin, a rule matching at least one transport level field 

12 of the packet; and 

13 a network interface coupled with the bus, the network interface to couple the system with 

14 an optical link. 

1 37. The system of claim 36, wherein the rule matching the at least one 

2 transport level field comprises a highest priority matching rule. 
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1 38. The system of claim 36, wherein the at least one transport level field of the 

2 packet includes a source port and a destination port, and wherein each rule of a bin 

3 includes a source port lower bound, a source port upper bound, a destination port lower 

4 bound, and a destination port upper bound. 



1 39. The system of claim 38, wherein the classification circuit comprises: 

2 a first comparison circuit to compare the source port of the received packet with the 

3 source port lower and upper bounds of one of the rules; 

4 a second comparison circuit to compare the destination port of the received packet with 

5 the destination port lower and upper bounds of the rule; and 

6 an output circuit to output a match signal if a rule of the corresponding bin matches the 

7 source and destination ports of the received packet. 

1 40. The system of claim 39, wherein the rule matches the source and 

2 destination ports of the received packet if: 

3 the source port of the received packet is greater than or equal to the source port lower 

4 bound of the rule and less than or equal to the source port upper bound of the rule; 

5 and 

6 the destination port of the received packet is greater than or equal to the destination port 

7 lower bound of the rule and less than or equal to the destination port upper bound 

8 of the rule. 
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1 41. The system of claim 36, wherein the corresponding bin further 

2 corresponds to a protocol associated with the received packet. 



1 42. The system of claim 41, wherein to identify a bin corresponding to a 

2 network path of a received packet, the processing engine is programmed to perform 

3 operations including: 

4 identifying, from a number of entries in a data structure, an entry having a source address 

5 prefix matching the source address of the received packet, the matching entry 

6 including a first identifier; 

7 identifying, from a number of entries in another data structure, an entry having a 

8 destination address prefix matching the destination address of the received packet, 

9 the matching entry including a second identifier; and 

10 identifying, from the number of bins, a bin corresponding to the first and second 

1 1 identifiers and the protocol. 
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1 43. The system of claim 41, wherein to identify a bin corresponding to a 

2 network path of a received packet, the processing engine is programmed to perform 

3 operations including: 

4 searching a source address data structure to find a first index and a third index, the first 

5 index associated with a fully specified filter having a source prefix matching the 

6 source address of the packet, the third index associated with a partially specified 

7 filter having a source prefix matching the source address of the packet; 

8 searching a destination address data structure to find a second index and a fourth index, 

9 the second index associated with a fully specified filter having a destination prefix 

10 matching the destination address of the packet, the fourth index associated with a 

1 1 partially specified filter having a destination prefix matching the destination 

12 address of the packet; 

13 forming a key from the first index, the second index, and the protocol; and 

14 searching a primary table for an entry matching the key, the primary table including a 

15 number of entries, each entry corresponding to one of a fully specified filter, a 

16 fully specified filter intersection, and an indicator filter; 

17 wherein an entry of the primary table matching the key will identify the corresponding 

18 bin. 
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1 44. The system of claim 43, wherein to identify a bin corresponding to a 

2 network path of a received packet, the processing engine is programmed to perform 

3 operations further including: 

4 searching a first of two secondary tables for an entry matching a key formed from the 

5 third index and the protocol, the first secondary table including a number of 

6 entries, each entry corresponding to a partially specified filter; and 

7 searching a second of the two secondary tables for an entry matching a key formed from 

8 the fourth index and the protocol, the second secondary table including a number 

9 of entries, each entry corresponding to a partially specified filter; 

10 wherein, if no match is found in the primary table, a matching entry in one of the two 

1 1 secondary tables will identify the corresponding bin. 

1 45. The system of claim 44, wherein, if no match is found in the primary table 

2 or either of the secondary tables, the corresponding bin comprises a default bin associated 

3 with an entire two-dimensional address space. 
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1 46. The system of claim 43, wherein to identify a bin corresponding to a 

2 network path of a received packet, the processing engine is programmed to perform 

3 operations further including: 

4 searching the source address data structure to find a fifth index associated with a wide 

5 filter having a source prefix matching the source address of the packet; 

6 searching the destination address data structure to find a sixth index associated with a 

7 wide filter having a destination prefix matching the destination address of the 

8 packet; 

9 forming a second key from the fifth index, the sixth index, and the protocol; and 

10 searching a wide filter table for an entry matching the second key, the wide filter table 

1 1 including a number of entries, each entry corresponding to a wide filter; 

12 wherein, if no match is found in the primary table, a matching entry the wide filter table 

13 will identify the corresponding bin. 

1 47. The system of claim 46, wherein each wide filter contained in the wide 

2 filter table comprises a fully specified filter having a number of indicator filters 

3 exceeding a specified threshold. 

1 48. The system of claim 36, wherein the memory comprises a static random 

2 access memory (SRAM). 
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1 49. An article of manufacture comprising: 

2 a machine accessible medium providing content that, when accessed by a machine, 

3 causes the machine to 

4 identify, from a plurality of bins stored in a memory, a bin corresponding to a 

5 network path of a received packet, each of the bins including a number of 

6 rules; 

7 issue a command to a classification circuit, the command identifying the 

8 corresponding bin; 

9 copy the rules of the corresponding bin from the memory to the classification 

10 circuit, wherein the classification circuit compares at least one transport 

1 1 level field of the received packet with each of the rules and provides a 

12 match signal if a rule matches the at least one transport level field of the 

13 packet; and 

14 in response to the match signal, apply an action associated with the matching rule 

15 to the received packet. 

1 50. The article of manufacture of claim 49, wherein the matching rule 

2 comprises a highest priority matching rule. 
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1 51. The article of manufacture of claim 49, wherein the at least one transport 

2 level field of the received packet comprises a source port and a destination port, and 

3 wherein each rule of a bin includes a source port lower bound, a source port upper bound, 

4 a destination port lower bound, and a destination port upper bound. 

1 52. The article of manufacture of claim 51, wherein a rule matches the at least 

2 one transport level field of the packet if: 

3 the source port of the received packet is greater than or equal to the source port lower 

4 bound of the rule and less than or equal to the source port upper bound of the rule; 

5 and 

6 the destination port of the received packet is greater than or equal to the destination port 

7 lower bound of the rule and less than or equal to the destination port upper bound 

8 of the rule. 
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1 53. The article of manufacture of claim 49, wherein the corresponding bin 

2 further corresponds to a protocol associated with the received packet. 

1 54. The article of manufacture of claim 53, wherein the content, when 

2 accessed, further causes the machine, when identifying a bin corresponding to a network 

3 path of a received packet, to: 

4 identify, from a number of entries in a data structure, an entry having a source address 

5 prefix matching the source address of the received packet, the matching entry 

6 including a first identifier; 

7 identify, from a number of entries in another data structure, an entry having a destination 

8 address prefix matching the destination address of the received packet, the 

9 matching entry including a second identifier; and 

10 identify, from the number of bins, a bin corresponding to the first and second identifiers 

1 1 and the protocol. 
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1 55. The article of manufacture of claim 53, wherein the content, when 

2 accessed, further causes the machine, when identifying a bin corresponding to a network 
, 3 path of a received packet, to: 

4 search a source address data structure to find a first index and a third index, the first index 

5 associated with a fully specified filter having a source prefix matching the source 

6 address of the packet, the third index associated with a partially specified filter 

7 having a source prefix matching the source address of the packet; 

8 search a destination address data structure to find a second index and a fourth index, the 

9 second index associated with a fully specified filter having a destination prefix 

10 matching the destination address of the packet, the fourth index associated with a 

1 1 partially specified filter having a destination prefix matching the destination 

1 2 address of the packet; 

13 form a key from the first index, the second index, and the protocol; and 

14 search a primary table for an entry matching the key, the primary table including a 

15 number of entries, each entry corresponding to one of a fully specified filter, a 

16 fully specified filter intersection, and an indicator filter; 

17 wherein an entry of the primary table matching the key will identify the corresponding 

18 bin. 
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1 56. The article of manufacture of claim 55, wherein the content, when 

2 accessed, further causes the machine to: 

3 search a first of two secondary tables for an entry matching a key formed from the third 

4 index and the protocol, the first secondary table including a number of entries, 

5 each entry corresponding to a partially specified filter; and 

6 search a second of the two secondary tables for an entry matching a key formed from the 

7 fourth index and the protocol, the second secondary table including a number of 

8 entries, each entry corresponding to a partially specified filter; 

9 wherein, if no match is found in the primary table, a matching entry in one of the two 
10 secondary tables will identify the corresponding bin. 

1 57. The article of manufacture of claim 56, wherein, if no match is found in 

2 the primary table or either of the secondary tables, the corresponding bin comprises a 

3 default bin associated with an entire two-dimensional address space. 
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1 58. The article of manufacture of claim 55, wherein the content, when 

2 accessed, further causes the machine to: 

3 search the source address data structure to find a fifth index associated with a wide filter 

4 having a source prefix matching the source address of the packet; 

5 search the destination address data structure to find a sixth index associated with a wide 

6 filter having a destination prefix matching the destination address of the packet; 

7 form a second key from the fifth index, the sixth index, and the protocol; and 

8 search a wide filter table for an entry matching the second key, the wide filter table 

9 including a number of entries, each entry corresponding to a wide filter; 

10 wherein, if no match is found in the primary table, a matching entry the wide filter table 

1 1 will identify the corresponding bin. 

1 59. The article of manufacture of claim 58, wherein each wide filter contained 

2 in the wide filter table comprises a fully specified filter having a number of indicator 

3 filters exceeding a specified threshold. 
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